bugZoneCheck - Bugs: bug #29967, XSS threats

 
 

bug #29967: XSS threats

Submitter:  None
Submitted:  Wed 26 May 2010 12:30:50 PM UTC
   
 
Category:  input Severity:  Critical
Priority:  9 - Immediate Item Group:  Crash/Error
Status:  Fixed Privacy:  Public
Assigned to:  chabannf Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 26 May 2010 03:27:30 PM UTC, comment #3: 
Fabien CHABANNE <chabannf>
Group Member
Wed 26 May 2010 02:12:24 PM UTC, comment #2: 

The right solution is probably to wrap every output with escapeHTML.

http://ruby-doc.org/core/classes/CGI.html#M000548

Stephane Bortzmeyer <bortzmeyer>
Group administrator
Wed 26 May 2010 01:57:07 PM UTC, comment #1: 

The original exploit uses the 'ns' parameter but the others are vulnerable as well (tested with 'zone'). No escape is done before writing the HTML.

Stephane Bortzmeyer <bortzmeyer>
Group administrator
Wed 26 May 2010 12:30:50 PM UTC, original submission:  

http://www.xssed.com/mirror/61096/

http://www.afnic.fr/outils/zonecheck/zc.cgi?afnic=1&zone=garlinludovic.fr&ns0=francofolibre.org&ips0=88.191.24.9&ns1=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C/script%3E

or


http://www.zonecheck.fr/cgi-bin/zc-limited.cgi?zone=afnic.fr&ns0=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&ips0=&ns1=&ips1=&ns2=&ips2=&ns3=&ips3=&ns4=&ips4=&ns5=&ips5=&ns6=&ips6=&ns7=&ips7=&intro=t&explain=t&details=t&progress=counter&report=byseverity&format=html&lang=fr&errorlvl=&profile=automatic&chkmail=t&chkzone=t&chkrir=t&transp3=ipv4&transp3=ipv6&transp4=std


Entered datas are not correctly escaped and fails against XSS exploits protection.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chabannf (Posted a comment)
  • -email is unavailable- added by bortzmeyer (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-22 chabannf Open/ClosedOpen Closed
    2010-05-26 chabannf StatusConfirmed Fixed
    2010-05-26 bortzmeyer SeverityHigh Critical
        Priority5 - Normal 9 - Immediate
        Item GroupAction request Crash/Error
        StatusNone Confirmed
        Assigned toNone chabannf

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code